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Unclassified 


The  Army  has  come  a  long  way  in  applying  the  Federal  Mana¬ 
gers’  Financial  Integrity  Act  of  1982  to  its  system  of  internal 
controls.  After  several  iterations  of  the  Army  regulation  and 
continual  efforts  by  HQDA,  MACQM,  and  i ns ta 1 1  a t i on / ? c t i v i t y 
practitioners,  the  result  has  been  a  relatively  effective,  low 
cost  program  achieving  reasonable  assurance  of  compliance  with 
Comptroller  General  standards.  Evidence  suggests,  however,  that 
continued  evolution  in  the  program  is  both  possible  and  desira¬ 
ble.  There  are  several  key  improvements  that  could  be  made, 
mostly  at  relatively  low  cost.  The  suggested  enhancements  focus 
on  execution,  by  improving  command  emphasis,  accountability, 
training,  publicity,  and  oversight,  and  putting  the  most  effort 
on  the  high  priority,  high  risk  areas.  Seme  recommended  struc¬ 
tural  changes  are  also  included,  primarily  aimed  at  designing 
better,  shorter  internal  control  review  checklists  and  simplify¬ 
ing  the  reporting  of  internal  control  weaknesses.  These  changes 
should  go  far  in  improving  the  program’s  image  both  within  and 
outside  the  Army,  and  provide  far  greater  benefits  than  simply 
assuring  compliance  with  Public  Law. 


INTRODUCTION 


The  reason  for  this  paper  is  to  propose  certain  improvements 
in  the  Army’s  internal  control  program.  To  date,  the  program  has 
been  success fu  1  in  preventing  major  scandaiS  01  significantly 
adverse  media  coverage.  It  has  also  identified  and  corrected  many 
material  weaknesses.  If  actively  employed  in  its  current  state, 
the  internal  control  program  should  continue  to  more  than  meet  hr. e 
minimum  standards  imposed  by  the  General  Accounting  Office  (GAO.1 
and  Federal  Managers’  Financial  Integrity  Act  (  F  M  F  I  A  )  of  1932. 

Experience  suggests,  however,  that  this  Army  program,  like 
many  others,  may  become  preempted  by  seemingly  more  important 
events  and  circumstances.  This  is  already  happening  in  some  com¬ 
mands  and  activities.  While  probably  remaining  a  legai  and  regula¬ 
tory  requirement,  the  program  will  increasingly  be  given  only  lip 
service  by  senior  Army  leadership.  This  will  degrade  subordinates’ 
accomplishment  of  the  program’s  purpose:  assuring  appropriate 
control  over  funds,  property,  and  other  assets.  Barring  changes  in 
program  structure  and  Army  leadership  attitudes  toward  internal 
control,  the  Army  may  ultimately  become  trapped  in  a  costly  cycle 
of  incremental  improvements  in  reacting  to  increasing  Congressional 
scrutiny  of  its  management  (including  internal  control)  practices. 


INTERNAL  CONTROL  SYSTEMS  l N  GENERAL 


The  need  for  internal  controls  has  probably  existed  ever  since 


some  person  or  persons  managed  the  funds,  assets,  property,  or 


business  affairs  of  some  other  person.  Man  is  not  inherently 

untrustworthy,  but  can  be  tempted  to  become  so.  The  prospect  of 

reaping  some  extra  unearned  economic  benefit  at  the  expense  of 

one’s  employer  has  necessitated  some  form  of  internal  controls  in 

most  businesses,  including  Government. 

There  are  many  definitions  of  internal  control.  The  GAO 

definition  is  most  applicable  to  this  discussion,  however,  as  it  is 

the  basis  for  all  US  Governmental  internal  control  systems: 

The  plan  of  organization  and  methods  and  procedures 
adopted  by  management  to  ensure  that  resource  use  is 
consistent  with  laws,  regulations,  and  policies;  that 
resources  are  safeguarded  against  waste,  loss,  and 
misuse;  and  that  reliable  data  are  obtained,  maintained, 
and  fairly  disclosed  in  reports. ^ 

Pertinent  to  this  definition  are  the  twelve  internal  control 

standards  established  by  the  Comptroller  General  (hereafter 

referred  to  as  the  twelve  GAO  standards):  reasonable  assurance: 

supportive  attitude;  competent  personnel;  control  objectives; 

control  techniques;  documentation;  recording  of  transactions  and 

events;  execution  of  transactions  and  events;  separation  of  duties; 

supervision;  access  to  and  accountability  for  resources;  and  prompt 

2 

resolution  of  audit  findings. 

Closely  following  the  internal  control  concept  of  the  American 
Institute  of  Certified  Public  Accountants,  the  GAO  approach 
practically  matches  that  of  American  private  industry.  The 
differences  are  mostly  in  execution  rather  than  system  design,  but 
there  are  a  few  interesting  disparities. 

Private  industry  lacks  the  stated  standard  of  prompt  audit 
compliance,  but  in  practice  this  standard  is  rigorously  applied. 
Either  the  internal  auditors  enforce  prompt  in-house  correction  of 
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audit  findings,  :r  the  external  auditors  refuse  to  certify  the 
financial  statements  of  the  business,  which  tends  to  force  prompt 
resolution  of  the  issues.  Either  way,  quick  reaction  to  audit 
findings  ensues. 

The  private  industry  approach  defines  a  whole  separate  set  of 
controls  over  information  systems.  Without  going  into  detail, 
information  systems  must  provide  relevant,  timely,  reliable, 
sufficiently  detailed  information  in  a  form  which  highlights  the 
important  data.  Distribution  of  the  information  must  match  tne 
ability  of  the  receiver  to  make  use  of  the  information,  and 
finally,  the  information  must  be  useful.  Information  systems  are 
judged  to  be  of  such  importance  and  present  such  a  high  degree  of 
risk  that  they  warrant  separate  consideration. 

The  private  industry  approach  stresses  a  cost-benefit  analysis 
of  internal  controls.  This  tends  to  preclude  the  establishment  of 
formal,  written  controls  due  to  the  cost  involved,  except  for  high 
risk  areas.  Once  the  unique  characteristics  of  the  particular 
business  are  understood,  then  a  risk  analysis  of  possible  outcomes 
with  their  associated  probabilities  of  occurrence  is  performed. 
Costs  of  emplacing  various  controls  are  compared  with  the  benefits 
of  avoiding  the  various  risks.  Control  objectives  and  techniques 
are  then  devised  and  effected  for  those  business  segments  where  the 
greatest  benefit  to  cost  advantage  can  be  derived.4 

in  practice,  the  high  risk  areas  typically  include  those 
conducive  to  fraud,  such  as  employee  travel  and  automatic  data 
processing.^  Fraud  control,  as  opposed  to  other  types  of  control 
such  as  administrative  or  accounting  controls,  enjoys  relatively 
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high  visibility  and  management  concern.  The  rest  of  the  internal 
control  program  has  low  visibility,  as  great  fait  hi  is  placed  or,  the 
overall  control  environment  to  achieve  internal  control  objectives. 
The  control  environment  is  defined  as  management’s  exhibited 
attitude  toward  internal  controls,  its  expectations  of  the  work 
force  as  embodied  in  a  well-publicized  work  code,  and  discipline  of 

g 

the  work  force. 

Internal  controls  are  employed  only  where  there  is  a  clear 
benefit  to  cost  advantage.  Redundant  controls  are  ruthlessly 
purged,  as  excess  cost  seems  to  be  more  easily  identifiable  in 
private  industry.  There  is  little  training  on  internal  controls 
except  for  auditors  and  some  accountants,  as  considerable  trust  is 
placed  on  job  descriptions  and  supervisory  experience. 

Usually  performed  by  the  internal  accounting  staff,  the 
evaluation  of  internal  controls  is  rarely  formal.  Instead, 
overwhelming  primacy  is  afforded  to  the  use  of  budget  variances  as 
the  means  of  internal  control. ^  The  supervisors  of  organization 
segments  have  their  approved  budgets,  which  are  themselves  subject 
to  considerable  scrutiny  and  analysis  in  private  industry’s 
planning,  programming,  and  budgeting  cycles.  Actual  results  are 
then  compared  in  great  detail  and  frequency,  often  daily,  against 
budgeted  figures.  This  budget  variance  concept  is  directly  linked 
to  the  profit,  or  bottom  line,  orientation  of  private  business  and 
is  therefore  probably  inappropriate  for  most  segments  of  the  not- 
for-profit  US  Government. 

Also  afforded  by  the  control  technique  of  budget  variance  is  a 
high  degree  of  accountability.  To  be  sure,  many  private  businesses 
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use  performance  appraisals  to  achieve  accountability,  especially 
big  corporations  and  companies  w ;  *■  h  large  staffs.  Performance 
appraisals  tend,  however,  to  be  used  more  for  professional 
development  rather  than  internal  control  purposes. ^  Depending  on 
the  business  structure  and  management  practices,  the  use  or 
variances  as  an  accountability  measure  can  pervade  the  entire 
structure  down  to  the  lowest  levels  of  management.  Again,  this 
approach  would  not  work  in  most  segments  of  the  Government.  In  t h 
Army,  for  instance,  the  installation  is  usually  the  lowest 
management  level  responsible  for  executing  a  comprehensive  budget. 
Although  their  expenditures  are  subject  to  periodic  scrutiny  by  a 
Program  Budget  Advisory  Committee,  installation  activities  are  not 
normally  subjected  to  the  microscopic  inspection  accorded  by  the 
private  sector’s  emphasis  on  budget. 

Additionally,  the  Go ve r nment - w i de  incentives  to  economize  are 
simply  not  the  same  as  in  private  industry.  Without  such  strong 
incentives  for  efficiency  and  economy,  Government  management  needs 
relatively  stronger  accountability  measures  other  than  the  use  of 
the  budget,  especially  at  the  lower  levels  of  management.  A  more 
definitive  requirement  for  reasonable  assurance,  with  clear  objec¬ 
tives  and  standards,  is  called  for.  Because  of  the  stewardship  of 
public  resources  and  the  responsibility  to  fulfill  the  public 
trust,  Government  requires  higher  performance  standards  and  rela¬ 
tively  more  training  on  its  internal  control  systems  than  does 
private  industry.  In  fact,  without  the  profit  motive,  Government 

may  even  need  internal  controls  to  ensure  that  basic  program 

q 

objectives  are  met. 
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"he  importance  of  a  strongly  supportive  control  environment  : 
any  internal  control  system  cannot  be  overemphasized.  1  r.  t n e 
absence  of  effective  internal  controls,  a  positive  control  e  n  v  i  ;  : 
ir.er.t  may  by  itself  be  enough  to  preclude  fraud  most  of  the  time. 

T  c  achieve  it,  management  must  spell  out  its  expectations  for  the 
•ork  force,  including  adherence  to  the  prescribed  control  system. 
The  internal  control  system  must  be  conducive  to  achieving  the 
collective  commitment  of  both  management  and  the  work  force.  This 
means  that  it  must  be  simple  and  practical  to  understand  and 
implement  in  every  activity  at  all  levels.  It  must  be  efficient  i 
its  use  of  time  and  resources,  preferably  utilizing  any  available 
internal  or  external  performance  measure  to  help  evaluate  control 
measures.  The  very  best  internal  control  system  would  be  one 
which,  implemented  as  a  normal  everyday  management  function,  does 
not  require  any  but  the  minimal  extra  effort  to  administer.  it 
would  also  be  effective  in  preventing  abuses  and  errors,  and  in 
identifying  and  correcting  such  faults.  The  totality  of  its 
control  environment,  standards,  objectives,  and  techniques  should 
suffice  to  solve  the  tough  problems  and  prevent  their  recurrence. 

The  ideal  Governmental  control  system  must  of  course  follow 
the  applicable  legal  and  regulatory  guidance,  which  requires 
enforceability  and  accountability.  To  hold  management’s  attention 
the  system  should  focus  mainly  on  high  risk  areas  and  known  prob¬ 
lems,  especially  those  identified  by  external  sources.  Finally, 
the  ideal  internal  control  system  should  be  self-policing:  it 
should  correct  itself  and  maintain  its  relevance  and  effectiveness 
under  all  conditions.  Unless  it  does  all  these  things,  the 
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eventually  lose  credibility 


eternal  ccntr ;  1  system  will  eventually  1 g s  e  credibility 
•.ana  cement  to:;.  It  will  cor.ti  nue  to  exist  because  the  i 
..st.  c  - 1  it  will  not  be  truly  effective. 


:  a  y  s 


ARMY  INTERNAL  MANAGEMENT  CONTROL  PROGRAM 

Internal  centre  1  has  bee-  around  the  US  Army  for  a  long  time, 
ever  since  General  Washington  appointed  General  von  Steuben  as  In- 

i  a 

specter  Genera!  to  enforce  supply  accountability.  Controls  with¬ 
in  Army  accounting  systems  have  been  in  effect  for  decades.  In  the 
recent  past,  the  genesis  of  the  current  system  of  internal  controls 
(now  called  the  Army  Internal  Management  Control  Program  (IMCP)), 
was  the  FMF I A  of  1982.  ll  Pursuant  to  the  Act,  the  Office  of 
Management  and  Budget  (0MB)  published  two  directives  (0MB  Circulars 
A  -  1 2  3  and  A -  1 2  7 )  implementing  the  Act  and  incorporating  the  twelve 
GAO  standards  for  internal  control  in  the  Federal  Government. 

In  response  to  these  directives,  the  Army  published  Army 
Regulation  (AR)  11-2  in  1933.  This  first  regulation  required  field 
activities  to  design  their  own  internal  control  objectives, 
techniques,  and  checklists.  DA  Pamphlet  11-6  described  how  to  do 
this.  By  1987  it  had  become  clear  that  the  consistency  afforded  by 
centralization  was  needed.  Consequently,  The  Secretary  of  the  Army 
directed  all  Headquarters,  Department  of  the  Army  (HQDA)  and  field 
operating  agency  (FOA)  functional  proponents  for  Army  subtasks  to 
develop  checklists  on  all  essential  event  cycles  for  Army-wide 
application.  These  are  now  contained  in  several  circulars  and 
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c  trier  directives  -'19  and  II,  respectively;  re  published  as  necessar. 
t o  ins o  r per  ate  needed  changes .  Further,  H Q D A  rescinded  DA  Pan  11- 
■= .  re-;;te  Aft  11-2.  and  published  the  Army  Management  Centre.  F  ;  a 
M C p •  in  a  DA  Circular . 

The  MCr  : s  unique  among  the  services.13  It  is  an  annually 
updated  E-year  plan  identifying  relative  risk  for  all  3 A -  Army 
subtasKs.  It  pinpoints  responsibility  at  all  levels  of  c  immar.d  r;r 
the  scheduled  application  of  the  checklists,  and  lists  the  related 
ARs  and  DA  Circulars.  As  a  concise  inventory  of  the  Army’s  entire 
internal  control  program,  it  bridges  the  gap  between  the  field’s 
programs  and  the  Army’s  policy  statement,  AR  11-2, 

Since  1983  there  have  been  three  revisions  of  AR  11-2.  It  now 
severs  the  twelve  GAO  standards  and  the  program’s  general  aspects. 
While  it  does  net  lay  out  a  "code  of  conduct"  for  military  and 
civilian  personnel,  it  does  suggest  that  such  a  code  be  used  to 
periodically  remind  personnel  of  their  internal  control  responsi¬ 
bilities.  AR  11-2  also  spells  out  the  roles  of  all  the  key  players 
in  the  iMCP,  from  the  Deputy  Assistant  Secretary  of  the  Army  for 
Financial  Operations  (DASA(FO))  and  Army  Internal  Control  Office 
( A I C  G ;  ail  the  way  down  to  the  assessable  unit  managers  (AUMs)  and 
commanders  and  managers  at  all  levels.  Recommended  job  standards 
for  various  internal  control  personnel  are  included  as  well.14 

Under  the  DASA(FO),  the  AICO  administers  the  IMCP  at  the  HCDA 
level.  This  includes  publishing  all  DA  Circulars  containing  inter¬ 
nal  control  checklists.  Tt e  AICO  periodically  informs  HQDA  func¬ 
tional  proponents,  and  major  Army  command  ( MACOM )  and  FOA  internal 
control  administrators  (ICAs),  of  audit/inspection  findings  on  the 
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pregram.  Finally,  the  AICO  publishes  Reminder  Lists,  5-year 
:  j  m  peneiums  of  weaknesses  identified  either  internally  via  the  1 M  C 
or  b;>  external  auditors  like  those  from  the  GAO. 

As  an  overseer  of  all  Army  programs,  The  Inspector  General 
'TIG1  is  cr.arged  with  reviewing  1  MCP  implementation  during  the 
normal  course  of  inspections.  TIG  also  provides  feeder  reports 
twice  annually  to  the  AICO  on  material  internal  control  weaknesses 
'MUs;.  This  fits  in  with  the  mandate  to  report  on  the  efficiency, 
effectiveness,  and  economy  of  Army  programs,  as  well  as  TIG’s  audi 
follow-up  responsibility.*^ 

Another  overseer,  the  Auditor  General,  is  also  charged  with 

biannual  feeder  reports  to  the  AICO,  in  addition  to  a  continuing 

analysis  of  the  IMCP,  corrective  actions  on  MWs  ,  and  an  annual 

report  to  the  Secretary  of  the  Army  assessing  the  overall  IMCP 
16 

status.  The  Auditor  General  accomplishes  this  by  means  of  the  US 
Army  Audit  Agency  (AAA),  an  Army  FOA  subject  to  public  audit 
standards  but  reporting  only  within  Army  channels. 

The  internal  control  role  of  the  commander’s  own  oversight 
agency,  Internal  Review  MR),  is  not  covered  in  AR  11-2  but  is 
addressed  in  AR  11-7.  IR’s  responsibilities  include  conducting 
various  types  of  audits  to  examine  economy,  efficiency,  effec¬ 
tiveness,  and  compliance  with  applicable  laws  and  regulations  and 
previous  audits.  IR  also  has  the  capability  of  performing 
functional  reviews,  trend  analyses  and,  more  importantly,  trouble¬ 
shooting  on  known  or  suspected  problems.*^  Not  included  in  the 
regulation  is  the  specific  function  of  routinely  assessing  and 
reporting  on  the  status  of  internal  controls  within  the  audited 
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activity,  as  a  matter  of  course  during  IR  audits.  !t  is,  hc.eVt:, 
included  in.  Governmental  auditing  stancards.1® 

is  internal  control  oversight  responsibility  of  auditors  an 
Inspectors  General  (IGs),  as  well  as  the  internal  control  function 
of  leaders  at  all  levels,  is  not  specifically  resourced.  That  is, 
there  are  neither  personnel  spaces  nor  operating  funds  earmarked 
for  the  IMCP  outside  of  six  personnel  and  a  small  pot  of  operating 

IQ 

funds  at  HQDA.  The  costs  of  IMCP  oversight  and  administration 
are  included  in  the  general  operating  budgets  of  the  various 
commands  and  activities,  but  not  as  separate  budget  items.  From 
HQDA  functional  proponents  and  MACOMs  down  to  ICAs  and  AUMs  at  the 
i ns ta  1  1  a t i on/ac t i v i ty  level,  the  IMCP  is  generally  considered  to 
require  only  part-time  effort  and  is  therefore  not  a  significant 
budget  item.  On  paper,  at  least,  the  IMCP  is  an  extremely  low  cos 
program. 

Eased  on  its  low  operating  cost  and  documented  results  in 
enabling  the  Army  to  meet  the  GAO  standards  as  well  as  the  spirit 
and  intent  of  the  FMF.A,  the  Army’s  IMCP  has  been  a  significant 
achievement.  As  reflected  in  the  latest  report  of  the  Auditor 
General,  the  IMCP  generally  empowered  the  Army  to  identify  and 
correct  MWs,  adequately  support  the  Secretary  of  the  Army’s  annual 
assurance  statement,  and  conclude  that  its  accounting  systems  were 
in  compliance  with  Comptroller  General  standards.^  The  Auditor 
General  concluded  that  the  Army  continued  to  display  reasonable, 
prudent  actions  in  complying  with  the  FMF1A.  Clearly,  the  IMCP  ha 
been  highly  successful  as  it  has  evolved  over  the  past  eight  years 
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CURRENT  PROGRAM  STATUS 


The  Army’s  iMCP,  according  to  a  variety  of  sources,  is  the 

21 

best  among  the  services  in  complying  with  the  FMFIA.  Responsive 
in  correcting  identified  MWs,  especially  those  uncovered  by 
external  agencies,  the  Army  program  has  evolved  into  a  well- 
administered  program.  The  Army  guidance  is  sound,  meets  legal 
requirements,  and  enables  the  key  players  to  understand  and  execute 
their  roles.  With  its  5-year  inventory  of  internal  control 
weaknesses  (the  Reminder  Lists  and  the  previous  MACOM/FOA  annual 
assurance  statements),  the  program  provides  a  sound  basis  for 
necessary  improvements.  Left  alone,  the  IMCP  would  probably 
continue  to  evolve  to  meet  any  new  administrative  requirements. 

Excellence  of  administration  is  not,  however,  the  only  measure 
of  success.  Despite  the  program’s  apparent  achievement  in  reducing 
the  number  and  severity  of  material  weaknesses,  there  has  been  a 
significant  deterioration  in  the  execution  of  the  program.  This 
deterioration  is  due  to  several  factors  which  will  be  discussed 
below.  It  is  important  to  stress,  however,  that  the  weaknesses  of 
the  IMCP  are  primarily  in  the  execution  of  the  program,  not  the 
program’s  structure. 

At  the  top  of  the  list  is  a  lack  of  command  interest  in  the 
IMCP.  Practitioners  (MACOM,  FOA,  and  installation  ICAs;  instal¬ 
lation  and  activity  AUMs  and  line  managers)  almost  unanimously 
agree  that  decreased  command  emphasis  in  recent  times  has  hurt  the 
program.^  This  is  supported  by  the  Auditor  General’s  1990 
report,  in  which  he  stated  that  of  all  the  audits  performed  on 
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activities  and  installations,  only  37%  indicated  proper  imple¬ 
mentation  of  the  IMCP.  Tfe  figure  for  1989  was  60%. ^ 

It  would  appear  that  there  is  a  wide  variance  in  the  degree  or 
emphasis  placed  on  the  program.  Some  commanders  lend  their  full 
support  throughout  the  year,  making  the  IMCP  a  matter  of  keen  com¬ 
mand  interest.  Unfortunately,  these  comprise  the  exception  rather 
than  the  rule.  Most  senior  leaders  concern  themselves  with  the 
program  only  near  the  end  of  the  year  when  they  must  submit  their 
annual  assurance  statements.  Their  commands  and  activities  then 
scramble:  internal  control  reviews  are  performed,  checklists  com¬ 
pleted,  feeder  assurance  statements  submitted  up  the  chain,  and  the 
command’s  assurance  statement  and  supporting  documents  prepared.  ^ 
Because  of  this  approach,  some  checklists  are  hurriedly  completed, 
sometimes  incorrectly.  Some  checklists  are  not  completed  in  time 

to  support  the  annual  assurance  statement,  so  commanders  submitting 
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assurance  statements  under  this  condition  do  so  on  faith. 

Another  result  of  the  last  minute  approach  (or  perhaps  an 

underlying  cause)  is  that  many  of  the  people  involved  in  IMCP 

administration,  from  the  line  manager  up  to  the  commander  or  senior 

manager  signing  his  assurance  statement,  perceive  the  whole 
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exercise  as  a  bureaucratic,  costly  paperwork  drill.  At  one  large 

installation,  the  commander  has  even  directed  his  ICA  to  perform 

all  internal  control  reviews  (and  complete  all  checklists)  to  spare 

27 

the  installation  staff  the  effort  of  dealing  with  the  program. 

This  attitude,  starting  with  top  management,  tends  to  drastically 
undercut  the  program’s  effectiveness.  As  with  any  Army  program, 
the  IMCP  draws  its  strength  (or  weakness)  from  the  leader. 
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There  are  probably  several  causes  for  the  lack  of  command 

emphasis.  As  always,  Army  leaders  have  "full  piates".  There  are 

man./  programs  and  priorities  competing  for  the  commander /  manager's 

interest  and  effort,  and  internal  control  is  just  one  of  a  myriad. 

Now  that  the  IN CP  is  an  established  Army  program  with  which  the 

command  structure  is  at  least  familiar,  if  not  totally  comfortable, 
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it’s  no  longer  a  "hot"  issue.  Other  issues  have  taken 
precedence.  Additionally,  the  IMCP  is  not  linked  to  any  other 
management  improvement  program.  It  therefore  operates  "on  a 
shoestring",  w i t h  little  external  support  other  than  the  legal 
requirement  for  compliance. 

Internal  control  is  often  perceived  as  accountant,  auditor,  or 
IG  business.  The  HQDA  proponent  for  the  IMCP  is  the  DASACFO), 
which  links  the  program  to  "beancounters".  Similarly,  other  high 
level  players  like  the  Inspector  General,  AAA,  Comptroller  General, 
and  GAO  are  viewed  with  a  jaundiced  eye  by  many  senior  leaders. 
Commanders  typically  view  auditors  with  mistrust,  accountants  with 
suspicion,  and  IGs  with  consternation.  With  these  biases  built 
into  our  senior  commanders  and  managers,  it  comes  as  no  surprise 
that  IMCP  receives  only  the  grudging  support  of  many. 

Some  commanders  have  little  interest  in  items  not  directly 
connected  with  warfighting.  Preferring  to  remain  in  the  domain  of 
operations,  these  commanders  leave  administration  to  some  unfortu¬ 
nate  subordinate  to  handle.  IMCP  problems  in  such  commands  are 

typically  submerged  until  they  become  too  big  to  handle,  resulting 
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in  inefficient  and  sometimes  ineffective  solutions. 

There  is  also  a  very  real  human  tendency  not  to  report 
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problems.  Senior  commanders  and  managers  want  to  be  seen  as  capable 
of  handling  anything  thrown  -.heir  way.  Reporting  material  weak¬ 
nesses  which  could  be  seen  as  a  failure  of  command  or  leadership  i = 
anathema  to  such  commanders  or  managers.  Alternatively,  there  are 
commanders  who  report  material  weaknesses  which  they  themselves 
have  no  hope  of  solving  at  their  level,  but  fail  to  report  weak¬ 
nesses  which  are  (or  should  be)  well  within  their  capability  of 
resolving.  Finally,  some  commanders  abuse  the  IMCP  by  reporting 
weaknesses  as  a  resource-garnering  method  rather  than  in  relation 
to  the  degree  of  materiality  of  the  risk. 

Whatever  the  case,  this  brings  us  to  the  next  fault  in  the 

system,  that  of  a  lack  of  uniform  application  of  the  term  "material 

weakness".  This  concept  looks  great  on  paper.  An  MW  is  defined  as 

the  relatively  serious  absence  of  or  noncompliance  with  an  internal 

control,  the  correction  of  which  is  required  to  support  or  reestab- 
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lish  reasonable  assurance.  The  concept  does  not,  however,  work 
wel 1  in  practice  when  the  application  and  definition  of  MW  is  left 
up  to  leaders  who  have  a  vested  interest  in  how  it  applies  to  their 
commands  and  activities.  Currently,  each  management  echelon  is 
empowered  to  make  the  decision  on  the  relative  significance  of  the 
internal  control  problem.  In  turn,  this  allows  each  echelon  to 
decide  whether  to  report  it  to  the  next  higher  level  as  an  MW  or  a 
lesser  internal  control  weakness  needing  correction,  or  to  omit  it 
entirely.  Consequently,  there  are  wide  variations  in  what  sorts  of 
MWs  are  reported.  Some  commanders  report  few  MWs;  some  report 
voluminously.  The  differences  cannot  be  ascribed  totally  to 
differences  in  leadership  or  to  command-unique  problems. 
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In  a  similar  vein,  there  are  some  MWs  not  identified  by  the 

IMCP  which  probably  should  have  been.  A  quick  look  at  the  Army’s 

nine  outstanding  MWs  reveals  that  only  three  were  identified  via 
33 

the  IMCP.  Four  of  the  nine  were  identified  solely  by  the  GAO. 

Most  of  the  MW's  corrected  in  1990  were  detected  and  reported 
through  the  IMCP,  but  the  especially  tough  and  yet  unresolved 
problems  were  identified  by  agencies  external  to  the  Army  manage¬ 
ment  structure.  Consequently,  the  Army  has  been  forced  to  react 
with  corrective  action,  instead  of  preventing  the  deficiencies  or 
at  least  identifying  them  early.  Sadly,  someone  in  the  Army 
probably  knew  about  each  of  these  tough  problems  but  was  somehow 
prevented  from  reporting  on  them. 

There  are  probably  some  major  MWs  which  have  not  yet  been 
identified  as  such,  much  less  resolved.  As  an  example,  the  1950 
Budget  and  Accounting  Procedures  Act,  as  amended  in  1956,  requires 
all  public  agencies  to  use  accrual  basis  accounting.  Other  basic 
and  generally  accepted  accounting  principles  include  depreciation 
of  capital  equipment,  capital  budgeting,  and  the  production  of  one 
and  only  one  set  of  financial  statements  truly  reflecting  all 
operations.  The  US  Government,  including  the  Army,  persists  in 
using  receipt  and  outlay  accounting,  without  depreciation  or 
capital  budgeting,  and  making  off-budget  expenditures.  Not  only 
contrary  to  generally  accepted  accounting  rules  and  concepts,  these 
practices  also  violate  Public  Law.  This  condition  has  yet  to  be 
identified  as  an  MW.  Perhaps  the  fault  is  too  obvious  and  there¬ 
fore  overlooked,  but  a  more  likely  explanation  is  that  it  is 
perceived  as  too  tough  to  handle,  at  least  for  now.  This  is 
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unfortunate,  because  the  "up  front"  identification  of  tough 
problems  to  Congress  can  often  lead  to  the  grant  of  funds 
specifically  earmarked  to  solve  such  problems. ^ 

Similarly,  there  have  been  long-standing  recurring  deficien¬ 
cies  which  somehow  persist  despite  continuing  efforts  to  resolve 
them.  Examples  are  property  accountability  and  contracting.  ^ 

While  corrective  changes  in  systems,  structures,  and  regulations 
are  constantly  being  made,  there  seems  to  be  a  lag  in  accounta¬ 
bility  measures.  This  is  an  important  issue  because  it  is  linked  to 
the  public  trust  and  confidence  placed  in  Army  commanders  and 
managers.  A  former  Chief  of  Naval  Operations  rightfully  observed 

that  the  lack  cf  accountability  results  in  a  loss  of  credibility 
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and  ultimately,  a  loss  of  authority.  While  there  is  legal 
accountability  for  certain  agents  of  the  Government  (finance  and 
accounting,  contracting,  and  civilian  personnel  officers), 
experience  shows  that  few  of  the  accountable  officers  are  truly 
held  accountable,  pecuniarily  or  otherwise.  Most  other  officials 
are  not  legally  responsible  for  their  acts  or  omissions.  This  fact 
makes  accountability  a  most  formidable  problem,  as  it  devolves  upon 
senior  leaders  to  hold  their  subordinates  accountable. 

One  of  the  rules  in  the  IMCP  is  that  those  personnel  with  key 
internal  control  responsibilities  will  have  standards  established 
regarding  those  responsibilities  in  their  job  performance  agree- 
ments.  Unfortunately,  this  does  not  guarantee  enforceability. 

The  inclusion  of  an  item  on  an  Officer  Evaluation  Report  (OER) 
Support  Form  does  not  require  that  a  corresponding  comment  be  made 
on  the  officer’s  OER.  Even  though  internal  control  is  a  special 
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interest  item  which  should,  according  to  Army  policy,  be  evaluated 

39 

in  the  QER,  there  is  no  mandatory  comment.  Additionally,  as  the 
GER  Support  Form  is  not  made  a  part  of  the  officer’s  official  file, 
the  failure  to  meet  a  stated  goal  on  internal  control  cannot  be 
detected  once  the  completed  QER  is  sent  to  HQDA,  unless  specifi¬ 
cally  addressed  on  the  OER. 

The  Noncommissioned  Officer  Evaluation  Report  has  a  section 
regarding  accountability,  but  no  bullet  comment  is  necessary  unless 

A  J 

the  standard  is  exceeded  or  not  met.  Similarly,  a  performance 
standard  for  a  critical  job  element  in  a  civilian's  performance 
plan  requires  a  comment  on  the  Civilian  Performance  Rating  only 
when  a  job  element  rating  of  ''exceeded”  or  "not  rated"  is  rendered, 
or  when  the  overall  rating  is  other  than  "fully  satisfactory".41 
Even  if  comments  on  the  various  rating  forms  are  made  regarding 
internal  control  responsibilities,  there  is  no  true  accountability 
unless  the  rating  officials  choose  to  enforce  it  and  make  cogent 
remarks  on  the  ratings. 

There  are  some  other  problems  with  accountability  in  the  1MCP. 
Apparently  there  are  still  some  internal  control  practitioners  who 
have  key  internal  control  responsibilities  but  lack  corresponding 
job  standards.  One  reason  for  this  is  that  AR  11-2  does  not 
spell  out  a  sample  job  standard  for  "all  others",  such  as  line 
managers  or  commanders  below  the  installation  commander.  A 
standard  for  line  managers  is  especially  needed,  because  the  line 
manager  is  usually  the  one  charged  with  installing,  checking,  and 
reporting  on  the  internal  controls  in  his  area  of  responsibility. 

Another  reason  for  a  lack  of  established  internal  control 
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standards  is  the  turnover  of  personnel  involved  with  the  IMCP.43 
Promotions  or  permanent  changes  of  station  can  make  it  difficult  to 
stay  in  compliance  with  the  regulation.  Turnover  of  personnel  also 
foments  recurring  d e f i c i enc i e s .  The  subordinate  managers 
responsible  for  internal  controls  can  rotate  and  thus  escape 
accountability  for  deficiencies,  or  the  superior  leaders  can  rotate 
and  miss/avoid  holding  subordinates  responsible. 

A  related  problem  is  the  Army’s  fragmentation.44  There  are 
literally  hundreds  of  subordinate  tenant  units  on  Army 
installations,  geographically  separated  from  their  parent  units. 
This  separation  makes  them  uniquely  vulnerable  to  internal  control 
deficiencies,  particularly  if  their  installation  support  agreements 
or  arrangements  with  parent  units  do  not  spell  out  internal  control 
responsibilities.  Personnel  turnover,  together  with  this 
geographic  fragmentation,  results  in  a  very  real  potential  for 
severe  internal  control  problems. 

Training  is  another  problem  area.  Personnel  who  do  not 
understand  their  roles  in  the  IMCP  cannot  be  expected  to  properly 
implement  it.  Commanders  or  senior  mangers  who  do  not  understand 
the  IMCP  cannot  reasonably  be  expected  to  support  it.  As  pointed 
out  by  a  former  Comptroller  of  the  Army,  people  do  not  accept 
readily  something  they  do  not  fully  comprehend,  especially  when  it 
affects  their  interests. 4^ 

IMCP  practitioners  universally  agree  that  training  on  the 
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program  needs  improvement.  Some  ICAs  and  many  AUMs  have  not  been 
trained  on  the  IMCP.  This  inhibits  their  effectiveness  in  applying 
the  checklists  and  administering  the  program.  Likewise,  many 
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auditors  and  IGs  apparently  lack  i MCP  training  and  tend  to  iocus 
exclusively  on  regulatory  compliance.47  Materiality  is  generally 
ignored  by  auditors/ IGs ;  hence,  any  deviation  from  regulation  or 
law  regardless  of  severity  constitutes  an  MW.4®  There  is  a 
fundamental  disconnect  between  the  auditor/ IG  focus  on  objective 
measures  and  the  subjective  concept  of  reasonable  assurance;  this 
can  be  rectified  by  training. 

Another  training  deficiency  is  the  dearth  of  training  for 
military  leaders  on  the  IMCP,  specifically  on  the  twelve  GAO 
standards.  This  subject  is  not  covered  in  any  noncommissioned 
officer  schools,  nor  is  it  broached  in  most  commissioned  officer 
courses.  There  are  probably  some  basic  or  advanced  officer 
courses,  depending  on  the  branch,  which  touch  on  the  IMCP.  The 
installation  management  course  has  a  block  of  instruction  which 

AQ 

normally  includes  the  IMCP.  However,  the  first  time  many  senior 
commanders  receive  instruction  on  the  IMCP  is  as  they  prepare  to 
put  pen  to  paper  on  their  annual  assurance  statements.  If,  as 
indicated  in  AR  11-2,  all  Army  military  and  civilian  managers  must 
understand  and  apply  the  GAO  standards,  then  some  instruction  is 
called  for.®* 

Despite  the  plethora  of  oversight  agencies  looking  at  the 
IMCP,  there  has  been  a  deterioration  in  the  program's  execution,  as 
described  earlier.  IGs,  I  RAC  (Internal  Review  and  Compliance) 
offices,  and  AAA  all  inspect,  audit,  or  examine  the  implementation 
of  the  IMCP  and  report  their  findings  IAW  their  applicable 
regulations.  According  to  Army  policy,  the  efforts  are  comple¬ 
mentary.^  In  practice,  however,  the  efforts  may  overlap  to  the 
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extent  that  the  field  is  bombarded  with  input. 

As  the  fiscal  year  grinds  on.  the  findings  of  AAA  and  TIG  are 
fed  to  the  A  ICO,  who  adds  them  to  the  Reminder  Lists  and  periodi¬ 
cally  publishes  "lessons  learned"  to  the  MACOMs  and  FOAs  as  techni¬ 
cal  advice.  These  items  in  turn  are  passed  down  to  ICAs,  and  at 
some  installations,  on  to  AUMs  in  their  appropriate  areas.  This  is 
probably  valuable  advice,  but  it  loses  its  oomph  when  overdone. 

That  is.  the  general  perception  is  that  there  is  a  flood  of  infor¬ 
mation  on  the  IMCP,  perhaps  too  much,  and  that  it  is  al 1  considered 
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to  be  of  prime  importance.  There  is  no  separation  of  what  is 

"nice  to  know"  from  what  is  viewed  as  of  overriding  concern  at 

higher  headquarters. 

On  the  other  hand,  there  seems  to  be  a  lack  of  reaction  to 
media  coverage.  Although  AR  11-2  includes  language  regarding  ad¬ 
verse  publicity  as  an  indicator  of  material  weakness,  there  appears 

to  be  little  application  of  the  principle.  A  case  in  point  is  the 

coverage  regarding  the  extensive  loss  of  arms,  training  ammunition, 
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and  explosives  by  various  elements  of  the  Reserve  Component. 

This  is  a  subject  of  intensifying  Congressional  scrutiny,  and  yet 
the  Physical  Security  subtask  continues  to  be  rated  as  "low"  risk 
and  Ammunition  Accountability  as  "medium"  risk  in  the  most  recent 
MCp.5A  This  is  not  to  say  that  the  IMCP  should  be  totally  driven 
by  the  media,  but  there  probably  should  be  more  sensitivity  to  such 
coverage  in  light  of  the  Army’s  stewardship  of  public  resources. 

In  this  regard,  there  are  a  number  of  risk  assessments  which  could 
be  way  off  base.  As  events  occur  and  circumstances  change 
significantly,  risk  assessments  performed  by  the  HQDA  proponents 
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should  be  more  subject  to  revision  than  they  are  now. 

Structurally  speaking,  there  appears  to  be  little  consensus  on 
ho w  to  ihange  the  1MCP.  There  is,  however,  near  unanimity  in 
stating  that  the  program  should  somehow  be  simplified  or  stream¬ 
lined.^  At  present,  AUMs  and  line  managers  typically  do  not  use 
the  checklists  as  a  management  tool.  If  they  did,  the  Auditor 
Sen era!  indicates  that  they  could  identify  and  correct  the  same 
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problems  identified  by  the  auditors. 

The  checklists  run  in  length  from  one  page  to  thirteen  pages. 

A  few  are  clearly  too  short  and  do  not  cover  all  the  necessary 
event  cycles.  Most  of  the  rest  are  way  too  long  for  use  by 
management  in  the  conduct  of  everyday  operations. ^  For  example, 
there  is  a  checklist  requiring,  among  other  things,  an  inventory  of 
toilet  paper  holders  to  ensure  that  they  are  of  the  roll  type  (to 
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allow  easy  dispensing  of  the  toilet  paper).  This  is  an  important 

issue,  but  not  a  key  internal  control.  The  recent  submission  of 

another  checklist  by  a  HQDA  functional  proponent  was  prepared  by  a 
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contractor  at  Army  expense.  As  might  be  expected,  it  contains 
far  too  many  event  cycles  and  tests  of  internal  controls  to  be  of 
any  practical  use,  but  probably  maximizes  the  contractor’s  profit. 

All  of  the  checklists  contain  considerable  "boilerplate”. 

This  satisfies  FMF 1 A  requirements  for  identification  of  event 
cycles,  internal  control  objectives,  techniques,  and  the  like,  but 
it  is  mostly  unnecessary  for  the  AUM  or  line  manager.  Instead, 
most  managers  use  the  ARs  and  their  own  managerial  judgment  in 
running  their  operations,  and  oniy  use  the  checklists  under  duress. 
At  present,  there  are  three  high,  three  medium,  and  seventeen 
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low  r:=k  subtasks  for  which  there  are  not  yet  any  published  check¬ 
lists.6®  The  high  risk  subtasks  have  been  considered  so  for  at 
least  a  year,  so  the  field  has  had  to  prepare  assurance  statements 
on  these  areas  without  the  benefit  of  approved  checklists.  The 
failure  of  the  functional  proponents  to  prepare  checklists, 
particularly  for  high  risk  areas,  tends  to  devalue  the  risk 
assessments  or  the  1MCP  itself. 

As  currently  produced,  all  event  cycles  are  of  equal  impor¬ 
tance  in  the  checklists.  Each  test  question  is  likewise  of  equal 
weight  compared  to  all  other  test  questions.  There  is  no  identi¬ 
fication  of  relative  risk  or  importance.  For  example,  a  test 
question  regarding  the  presence  of  the  applicable  regulations  is  of 
equal  weight  compared  to  a  test  question  concerning  performance 
indicators  of  success  or  failure  of  the  internal  control  measure. 
Both  questions  are  indeed  important,  but  the  line  manager  will 
normally  skip  over  the  first  one.  The  point  is  that  the  current 
checklists  do  not  focus  on  the  more  important  issues. 

Finally,  the  checklists  are  published  seemingly  haphazardly 
without  a  clearly  understandable  index.  The  DA  Circulars  contain  a 
varying  number  of  checklists  which  are  either  totally  new  or 
revised  from  previous  checklists,  apparently  randomly  published  as 
received  by  the  AICO.  The  changes  are  not  highlighted,  either. 
Since  the  checklists  are  published  separately  from  the  supporting 
ARs,  some  mismatches  are  inevitable.  The  checklists  tend  to 
contain  the  latest  changes  in  Army  policy  and  procedures,  because 
it  is  far  simpler  and  quicker  to  publish  a  DA  Circular  than  an  AR. 
Unfortunately,  the  resulting  confusion  can  allow  a  manager  undue 
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leeway  in  interpreting  how  his  program  should  run,  and  it  can  also 
contribute  to  a  loss  of  confidence  in  the  IMCP  itself. 

As  a  management  tcc  1  ,  the  IMCP  is  highly  dependent  for  its 
effectiveness  upon  everyone’s  belief  in  the  program.  The 
d  e  f  icier  ties  in  the  program  identified  above,  by  detracting  from 
ton  fide nee  and  credibility,  must  therefore  be  corrected. 

RECOMMENDATIONS  FOR  CHANGE 

The  focus  of  the  recommended  changes  to  the  IMCP  is  on 
enhancement  of  the  program’s  execution,  with  a  corresponding  set  of 
key  structural  alterations  to  simplify  that  execution.  Publicity 
should  necessarily  attend  these  changes.  As  a  key  means  of 
introducing  change  and  winning  support,  publicity  would  be 
particularly  effective  If  done  through  command  channels,  since  the 
IMCP  is  a  command/management  program.  Attention  should  be  focused 
on  the  positive,  management  improvement,  and  simplification  aspects 
of  the  changes,  although  any  accountability  issues  should  also  be 
addressed.  In  this  manner,  the  field,  Including  leaders  at  all 
levels,  will  see  the  IMCP  improvement  effort  as  an  integrated 
approach  to  making  their  jobs  easier.  The  natural  resistance  to 
change  will  be  overcome,  and  implementation  and  enforcement  will  be 
easier.  Consequently,  the  basic  control  environment  for  internal 
control  will  be  strengthened. 

To  infuse  new  life  into  the  program,  command  emphasis  must  be 
increased.  It  must  start  at  the  top,  trickle  down  throughout  the 
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Army,  and  pervade  the  entire  force,  both  active  and  reserve 

components.  A  suitable  forum  to  kick  off  the  program  changes  migh 

be  the  Army  Commanders’  Conference  or  some  other  senior  leaders’ 

conference.  Whichever  forum  is  used,  top  Army  civilian  and 

military  leadership  should  be  in  attendance.  This  will  demonstrat 

the  Secretary  of  the  Army’s  commitment  to  making  the  IMCP  work. 

The  notion  that  the  IMCP  is  a  management  tool,  a  "force 

multiplier"  by  virtue  of  its  enhancement  of  resource  management, 

should  be  stressed.  Many  people  regard  any  internal  control  as  an 

unnecessary  cost.  This  perception  can  be  effectively  combatted  if 

the  benefits  of  internal  control,  in  terms  of  hard  cost  savings  or 

fraud,  waste,  and  abuse  prevention,  can  be  demonstrated. 

A  related  concept  that  will  help  win  support  is  that  the  IMCP 

is  also  a  wartime  program.  Internal  control  over  scarce  resources 

will  conserve  their  availability  for  both  wartime  and  peacetime 

operations.  The  Chief  of  Staff  of  the  Army  recently  published  a 

memorandum  cautioning  commanders  to  confine  the  use  of  funds 

earmarked  for  Operation  Desert  Shield  (now  Desert  Storm)  to  that 
61 

operation  only.  This  exemplifies  the  fact  that  internal  control 
applies  equally  to  wartime  operations. 

Yet  another  key  idea  is  that  commanders  and  managers  are 
stewards  of  public  resources  which  must  be  carefully  husbanded. 

The  various  oversight  agencies  such  as  GAO,  AAA,  and  TIG  cannot 
successfully  police  the  Army  alone.  Leaders  at  all  levels,  adher¬ 
ing  to  the  twelve  GAO  standards  and  employing  the  IMCP  as  a  tool, 
must  maintain  the  proper  control  environment  and  enforce  the  rules 
Another  way  to  add  to  command  emphasis  is  to  provide  periodic 
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feedback  to  commanders,  as  opposed  to  ICAs  or  other  staff 
technicians,  on  the  status  of  the  '  MCP .  This  will  keep  the  program 
on  *  -  e  :  r  o  n  t  burner,  even  if  on  "lew  heat".  A  related  method  that 
could  be  recommended  to  commanders  is  to  use  their  review  and 
analysis  programs  to  keep  themselves  apprised  of  I MCP  actions  in 
their  own  commands.  This  would  increase  the  awareness  and  interest 
levels  in  their  commands. 

increased  command  emphasis  can  also  be  achieved  through 
improved  accountab i 1 i ty ,  but  this  must  be  done  carefully.  Com¬ 
manders  and  senior  managers  are  already  responsible  for  everything 
their  subordinates  do  or  fail  to  do.  There  is  a  requirement  for  a 
comment  on  the  OER  or  Civilian  Performance  Rating  addressing  the 
ineffectiveness  of  corrective  actions  on  audit  findings,  although 
this  is  not  a  well-known  fact.  This  provision  could  be  added  to 
AR  11-2,  as  could  language  recommending  the  use  of  1MCP  results  as 
a  performance  measure.  The  new  version  of  the  OER,  when  fielded, 
couid  include  a  block  on  "accountability"  on  the  front  side  and/or 
a  mandatory  reference  to  IMCP  implementation  or  audit  results.  The 
same  goes  for  the  Civilian  Performance  Rating,  in  which  a  job 
element  called  "Internal  Control"  could  be  made  mandatory  for 
supervisors.  After  all,  the  law  applies  to  commanders  and  managers 
at  all  levels.  In  any  case,  every  leader  with  key  internal  control 
responsibilities  should  have  those  responsibilities  documented  in  a 
job  element  or  OER  support  form.  This  is  already  a  well-known 
requirement,  so  there  is  no  excuse  for  deviation. 

With  respect  to  the  Total  Army  workforce,  a  solid  contribution 
to  the  control  environment  could  be  made  by  publishing  a  "code  of 
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conduct"  or  set  of  expectations  for  conduct  at  all  levels.  This 
could  be  published  either  separately  or  as  a  part  of  AR  11-2.  A 
good  start  point  is  the  management  framework  described  by  the  Sec¬ 
retary  of  Defense  in  the  Defense  Management  Review,  where  he  laid 
out  expectations  for  individuals,  managers,  and  senior  leaders. 

Commanders  and  managers  usually  respond  well  when  allowed  to 
participate  in  objective  and  goal-setting  (management  by  objectives 
iMBO)).  That  concept  is  already  a  part  of  the  I MCP  through  the 
application  of  the  term  "reasonable  assurance".  By  rendering 
assurance  statements,  managers  implicitly  examine  actual  perfor¬ 
mance  against  their  own  goals  and  standards  as  they  determine 
whether  reasonable  assurance  has  been  achieved. 

A  way  to  demonstrate  to  leaders  that  they  have  a  crucial  role 
in  the  IMCP  is  to  recommend  they  set  explicit  performance  goals  or 
standards  on  reasonable  assurance  for  the  various  controls  within 
their  commands  or  activities.  This  could  be  8 0%,  95%,  99%,  or  even 
an  absolute  100%  depending  on  the  subject,  whatever  is  right  for 
that  command  or  activity.  The  idea  to  get  across  is  that  although 
the  IMCP  is  mandated  by  Public  Law  and  administered  at  the  HQDA 
level,  senior  leaders  play  a  key  role  by  establishing  their  own  ap¬ 
propriate  standards.  This  would  combat  the  perception  of  the  IMCP 
as  just  another  mandatory  program  which  interferes  with  the  real 
business  of  command  or  management.  Similarly,  the  program  should 
be  promoted  as  a  means  of  ultimately  improving  productivity.  While 
there  are  definitely  short  term  costs  in  rigorously  applying  any 
internal  control  program,  there  are  long  term  productivity  payoffs 
through  the  reduction  of  losses  due  to  fraud,  waste,  and  abuse. 
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The  application  of  goals  and 


standards  has  another  benefit. 


that  of  allowing  commanders  and  supervisors  to  appiy  management  by 
exception  .MBE!.  This  technique  encourages  management  to  exert 
of.'oio  1 1  aicai  no  t  in  compliance  with  the  established  goals  or 
standards.  headquarters,  USAREUR  and  Seventh  Army  has  applied  this 
technique  by  removing  the  requirement  for  feeder  assurance 
statements  from  subordinate  commands,  and  letting  the  MW  reports 
suffice  to  show  any  significant  problem  areas.  ’  Perhaps  this 
could  be  done  in  other  MACOMs  or  even  Army-wide. 

In  its  recognition  that  only  a  few  problems  are  of  a  truly 
critical  nature,  MBE  is  also  applied  by  focusing  the  internal 
control  effort  on  areas  most  vulnerable  to  fraud,  waste,  or  abuse. 
The  MCP  does  this  by  requiring  internal  control  reviews  of  high 
risk  areas  every  two  years,  as  opposed  to  once  every  five  years  for 
iow  and  medium  risk  areas.  Because  of  the  submission  of  assurance 
statements  annually,  consideration  should  be  given  to  changing  the 
requirement  to  an  annual  review  of  high  risk  areas.  In  all 
probability  this  is  being  done  by  AUMs  anyway. 

The  AICO  periodically  publishes  lessons  learned,  as  discussed 
earlier.  By  applying  MBE,  the  AICO  would  publish  only  the  most 
important  items  as  they  became  known,  and  save  the  rest  for  inclu¬ 
sion  with  the  semiannual  Reminder  Lists.  Alternatively,  the  AICO 
could  establish  a  "top  ten",  "top  twenty",  or  "Army  MW  List"  based 
on  the  Secretary  of  the  Army’s  annual  assurance  statement  and  the 
5-year  history  embodied  in  the  Reminder  Listings.  Audit  findings 
or  information  from  other  sources  pertaining  to  these  MWs  or  other 
critical  weaknesses  would  then  immediately  go  out  when  received  by 
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the  AICCl  to  the  I  C  A  s  and  HQDA/FQA  functional  proponents.  Presum¬ 
ably,  MWs  would  constitute  the  majority  of  AlCO’s  key  issues; 
adverse  reports  of  inadequate  follow-up  action  would  also  be  of  the 
utmost  concern  to  the  field.  All  other  audit  results,  indicators, 
or  lessons  learned  would  be  included  with  the  Reminder  List s . 

The  application  of  MBE  would  also  pertain  to  HQDA/FOA  func¬ 
tional  proponents  for  the  various  Army  tasks  and  subtasks.  For 
example,  when  internal  controls  fail  to  achieve  their  intended 
purpose,  the  result  is  often  manifested  in  adverse  media  publi  city 
or  external  reports  such  as  reports  of  audit  from  the  GAO.  This 
"out-of-balance"  condition  should  theoretically  initiate  MBE  and 
cause  some  reactions. 

One,  there  should  normally  be  an  immediate  effort  at  HQDA  to 
research  and  fix  the  problem,  if  a  problem  of  great  magnitude  truly 
exists.  Problems  at  an  audited  installation  or  activity  often 
indicate  Army-wide  problems.  If  necessary,  due  to  the  immensity  or 
sensitivity  of  the  problem,  a  ”T i ger  Team”  consisting  of  high- 
powered  functional  experts  should  be  formed  to  troubleshoot.  This 
approach  is  ideal  in  resolving  long  term  recurring  deficiencies, 
but  applies  equally  well  in  fixing  short  term,  high  risk  problems. 
Causative  research  to  get  at  the  root  causes  of  problems  should 
also  be  used  when  appropriate. 

Two,  the  functional  proponent  should  review  the  reported 
corrective  action,  if  any,  to  determine  its  efficacy.  If  the 
corrective  action  will  be  insufficient  to  solve  the  problem,  either 
in  the  short  or  long  run,  then  the  functional  proponent  should  take 
steps  to  improve  the  solution  as  appropriate. 
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Three,  the  functional  proponent  should  compare  the  publicity/ 
audit  results  with  the  risk  assessment  already  performed,  to  deter¬ 
mine  whether  a  change  in  the  latter  is  in  order.  There  are  provi¬ 
sions  for  this  in  the  IMCP,  but  they  are  apparently  not  routinely 
invoked.  In  November  1989,  for  example,  the  GAO  reported  that  the 
Army  had  failed  to  properly  control  contractor  access  to  the  supply 
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system  and  devise  an  appropriate  accounting  system.  Corrective 
action  on  this  MW  is  underway,  but  there  has  been  no  upgrade  of  the 
risk  assessment  for  at  least  two  of  the  related  subtasks  (wholesale 
stock  control  and  inventory  control;  by  coincidence,  the  latest  MCP 
indicates  that  there  is  not  yet  a  published  checklist  on  wholesale 
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stock  control).  As  all  347  Army  subtasks  are  scheduled  for  risk 
reassessment  in  FY91,  some  of  them  should  reflect  the  impact  of 
adverse  publicity  or  audit  results  of  previous  months.  A  way  to 
improve  the  reaction  to  adverse  publicity  might  be  to  have  the  Army 
Public  Affairs  Office  feed  such  input  to  the  AICO,  for  further 
dissemination  to  HQDA/FQA  functional  proponents  as  appropriate. 
Additionally,  the  AICO  should  be  required  to  review  and  chop  on  the 
functional  proponents’  risk  assessments  in  light  of  external 
reports  and  indicators,  as  the  honest  broker  for  the  IMCP. 

Four,  the  functional  proponent  should  evaluate  the  applicable 
ARs  for  possible  changes,  not  to  mention  the  related  internal  con¬ 
trol  checklists.  There  is  usually  a  prompt  attempt  by  well-meaning 
commanders  and  managers  to  solve  new  1 y- i dent i f i ed  problems,  but  the 
corresponding  changes  to  Army  po 1 i c i es / r egu 1  at i ons  seem  to  be 
longer  in  coming.  The  application  of  MBE  might  speed  this  process. 

Another  method  that  has  been  suggested  is  to  apply  Total 
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Quality  Management  (TQM)  to  the  iMCP  to  improve  its  efficiency.  A 
DC SLOG  study  on  this  concept  indicates  that  there  might  be  strong 
support  for  such  a  course  of  action  at  lower  levels,  but  top  Army 
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leadership  support  at  this  time  is  doubtful.  Key  TQM  concepts 
such  as  quality  circles  and  statistical  measurement  easily  lend 
themselves  to  application  within  the  IMCP.  Others,  such  as  direct 
customer  feedback  and  employee  ownership  of  the  process,  are  not  so 
easily  employed.  In  the  early  days  of  the  effort  to  comply  with 
the  FMFIA,  the  initial  approach  to  decentralized  development  of 
internal  control  checklists  would  probably  have  supported  the 
application  of  TQM  if  the  concept  had  been  in  vogue  at  that  time. 
Now,  with  the  centralized  approach  to  internal  control,  TQM  would 
be  tougher  to  employ.  Still,  the  idea  bears  further  consideration. 

The  next  major  problem  area  of  execution  is  training.  In  this 
era  of  declining  resources,  it  would  be  difficult  to  justify  insti¬ 
tuting  an  Army-wide  training  program  on  the  IMCP.  Within  existing 
programs  of  instruction  for  military  personnel,  however,  there 
should  be  some  coverage  of  the  IMCP  and  the  twelve  GAO  standards. 
NCOs  should  be  exposed  to  it  in  their  advanced  NCO  course;  officers 
should  get  it  in  their  basic  and  advanced  courses.  Installation 
commanders  and  their  deputies  should  continue  to  receive  such 
instruction  in  the  installation  management  course.  It  should  be 
briefly  touched  upon  in  the  battalion  and  brigade  pre-command 
course.  In  all  cases,  including  civilian  training  courses  on  the 
subject,  emphasis  should  be  placed  on  basic  management  responsi¬ 
bilities,  especially  stewardship  of  public  resources,  and  the  use 
of  the  IMCP  as  a  management  tool.  Improved  training  of  commanders 
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and  managers  should  also  increase  command  emphasis  on  the  IMCP. 

The  i MCF  practitioners  should  not  be  neglected  in  this  regard 
either.  It  would  be  helpful  if  new  ICAs  could  attend  the  Army  Man 
agement  Engineering  College  course  on  internal  control.  Space  and 
: unding  should  be  made  available  for  I G ,  IR,  and  AAA  personnel  as 
well.  Alternatively,  the  AICO’s  IMCP  videotape  or  the  OMB  interna 
control  training  module  could  be  made  widely  available  to  instal¬ 
lations  and  activities  for  their  use  in  training  commanders,  ICAs, 
AUMs,  IR  auditors,  and  IGs.  A  training  module  distributed  Army¬ 
wide  would  do  wonders  for  IMCP  consistency.  While  any  incremental 
costs  incurred  on  training  are  a  strong  negative  factor,  solid 
understanding  of  the  program  would  become  much  more  widespread. 
More  importantly,  the  effort  would  help  underwrite  reasonable 
assurance  and  ensure  Army-wide  consistency  in  the  program. 

Another  method  of  improving  the  support  for  reasonable 
assurance  would  be  better  coordination  of  the  oversight  function. 
As  previously  discussed,  the  Auditor  General  and  AAA,  TIG  and  the 
field  1G  network,  and  IRAC  sections  throughout  the  Army  perform  a 
full  court  press  in  reporting  on  the  IMCP  implementation  status. 
Each  of  these  agencies  has  a  valid  role  in  evaluating  the  IMCP,  in 
accordance  with  their  respective  charters.  There  may  be  a  better 
way  to  make  their  efforts  more  complementary,  however,  while 
leaving  the  basic  charters  unchanged. 

DoD  has  identified  the  need  for  better  early  warning  of  the 

gQ 

existence  of  MWs.  This  function  could  be  well  performed  by  the 
IG  network.  The  IG,  through  both  the  inspection  and  investigation 
functions,  is  ideally  suited  to  the  early  identification  of 
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potential  or  actual  internal  control  weaknesses. 

Among  its  other  functions,  1 R  performs  functional  reviews  and 
management  studies.  This  puts  I R  in  the  unique  position  of  being 
able  to  solve  internal  control  problems  for  the  commander.  Besides 
simply  auditing  functional  areas,  1R  can  reserve  space  on  its 
annual  schedule  for  IMCP  troubleshooting.  This  would  not  only 
support  the  IMCP,  but  would  upgrade  IR’s  credibility  as  a 
management  tool  . 

The  last  leg  of  the  Army’s  oversight  triad  is  AAA.  AAA  is  a 
relatively  unbiased  organization  operating  more  or  less  indepen¬ 
dently.  This  modus  operandi  makes  AAA  the  best  qualified,  if  not 
the  only,  Army  agency  to  independently  validate  reported  corrective 
actions  on  significant  internal  control  weaknesses  in  selected 
areas.  MWs,  findings  from  GAO  audits,  and  items  from  the  AlCO’s 
Reminder  Listings  could  all  be  included.  Related  to  the  audit 
followup  function  performed  by  AAA  anyway,  this  would  go  far  in 
enhancing  accountability,  consistency  of  effort,  command  emphasis, 
and  credibility  of  assurance  statements.  It  is  this  follow-up/ 
feedback  loop,  examining  reported  corrective  actions  in  functional 
areas,  which  has  heretofore  been  largely  absent,  Army-wide.  The 
change  in  AAA  focus  to  checking  on  corrective  actions  would  signi¬ 
ficantly  reduce  recurring  deficiencies.  AAA  would  also  continue  to 
audit  Army  accounting  systems  and  annually  report  on  the  Army’s 
IMCP  status,  to  provide  an  overview  from  the  audit  standpoint. 

The  oversight  agencies  would  thus  continue  to  act  in 
accordance  with  their  charters,  but  the  emphasis  would  change 
somewhat.  The  IG  would  become  the  early  warning  agent;  1R  would 
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focus  on  problem  solving;  and  AAA  would  validate  corrective 
actions.  In  this  manner,  their  roles  would  become  much  more 
complementary.  An  additional  way  to  link  all  these  agencies 
together,  but  also  tie  in  the  A! CO  -  !CA  network,  would  be  to 
periodically  nest  a  conference  via  some  computer  communications 

fig 

network  such  as  CQAHGST.  Key  weaknesses  or  audit/IG  findings 
could  be  discussed  and  disseminated  instantaneously,  eliminating 
the  time  lags  now  experienced  in  getting  the  information  collated, 
reproduced,  and  shipped  out  to  the  field.  The  key  players  would  be 
tasked  to  prepare  agenda  items  in  advance,  to  focus  attention  on 
only  the  most  salient  issues. 

Another  means  of  upgrading  program  oversight  could  be  to  track 
corrective  actions  via  the  AlCO’s  Reminder  Listings.  This  would 
keep  the  field  and  oversight  agencies  apprised  of  the  status  of 
efforts  to  solve  internal  control  problems.  As  a  synopsis  of  all 
known  findings  relating  to  the  various  Army  subtasks,  they  could 
become  the  trigger  mechanism  for  functional  proponents  to  change 
their  risk  assessments,  constitute  Tiger  Teams  to  solve  significant 
emerging  problems,  or  even  direct  Army-wide  internal  control 
reviews  in  selected  subtasks.  Automation  of  the  checklists  might 
be  yet  another  way  to  speed  and  simplify  dissemination  of  the 
information/®  Thus,  the  Reminder  Listings,  like  the  other  elements 
of  the  current  1MCP,  are  a  valuable  tool  which  can  greatly  improve 
the  program’s  execution  with  a  little  more  emphasis  and  more 
widespread  awareness. 

Informed,  aggressive  execution  is  the  key  to  improving  the 
Army’s  implementation  of  the  IMCP  and  FMFIA.  There  are,  however. 
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some  structural  changes  which  could  be  of  substantial  benefit  in 
improving  execution.  At  the  top.  the  A l C j  could  be  m o v e d  fro m 
DAS A  FC  directly  under  the  Secretary  or  Undersecretary  of  the 
Army.  Attenuating  the  link  between  the  1MCP  and  the  "beancounters" 
would  out  down  on  the  perception  of  the  program  as  strictly  an  au¬ 
ditor  or  accountant  program.  Placing  it  at  the  highest  level  of  DA 
would  immediately  bolster  senior  management  support  of  the  program, 
thereby  also  improving  the  control  environment.  The  IMCP  is  now  a 
peripheral  concern  of  senior  leadership.  Moving  the  program  agent 
as  suggested,  combined  with  the  other  execution  initiatives 
previously  discussed,  would  give  it  a  much  more  central  position. 

At  MACGMs,  FOAs,  and  installation/activities,  the  ICAs  should 
probably  remain  part  of  the  resource  management  staff  structure. 
This  would  minimize  any  organizational  dislocation,  preclude  a 
massive  training  effort  of  practitioners  beyond  that  already 
discussed  above,  and  take  advantage  of  the  professional 
accountant’s  orientation  toward  internal  control,  audit,  and 
stewardship,  as  many  ICAs  are  professional  accountants.  Accounting 
and  auditing  will  always  play  starring  roles  in  the  IMCP  given  the 
very  nature  of  the  program.  Some  leaders  would,  however,  move 
their  ICAs  to  a  more  central  position  given  the  similar  move  at  the 
HQDA  level.  Either  way  would  work. 

As  indicated  earlier,  the  practitioners  almost  unanimously 
voiced  their  desire  for  simplification.  With  the  specificity  of 
the  FMF I A  and  the  twelve  GAO  standards,  simplification  will  not  be 
an  easy  task.  There  are  some  possibilities,  however,  which  would 
improve  IMCP  implementation  at  the  grassroots  level. 
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Second,  a  review  of  all  checklists  should  be  made  for 
completeness,  redundancy,  and  appropriateness.  That  is,  a  scrub  of 
every  checklist  should  be  performed  to  ensure  that  the  appropriate 
internal  control  objectives,  techniques,  and  test  questions  exist 
to  ensure  reasonable  assurance.  Redundant  or  non-essential  items 
should  be  eliminated,  and  any  missing  items  developed.  Candidates 
for  removal  should  include  items  that  would  be  highlighted  via 
other  means,  like  customer  complaints  (example:  cylindrical  toilet 
paper  holders).  Once  and  for  all,  the  resuit  will  be  a  set  of 
checklists  that  should  not  significantly  change  unless  the  basic 
regulation  changes.  These  checklists,  when  applied,  will  suffice 
to  meet  the  full  spirit  and  intent  of  the  FMFIA. 

Third,  every  finalized  checklist  should  be  made  a  part  of  the 
applicable  AR  upon  the  publication  of  the  next  iteration  of  the  AR. 
Obviously,  conflicts  between  ARs  an-'  checklists  would  be  eliminated 
by  this  step.  It  will  also  avoid  the  waste  involved  in  publishing 
two  sets  of  guidance  pertinent  to  the  various  subtasks,  as  well  as 
the  problems  associated  with  the  current  lack  of  an  index  system 
for  the  DA  Circulars  containing  checklists.  A  related  step  should 
be  the  addition  of  the  A1C0  in  the  staffing  of  all  regulations  with 
internal  control  checklists. 
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The  next  measure  is  suggested  as  a  means  of  improving  AUM  and 
iine  manager  application  of  the  IMCP  to  their  everyday  management 
efforts.  These  managers  now  mostly  disdain  the  current  checklists, 
because  most  of  the  checklists  are  far  too  detailed  and  contain  a 
significant  amount  of  boilerplate,  as  described  earlier.  Some  test 
questions  "cover  the  bases"  but  do  not  address  only  the  key  inter¬ 
nal  controls.  "No"  answers  to  many  questions  would  not  necessarily 
show  key  internal  control  weaknesses.  Yet  these  checklists  suffice 
to  satisfy  the  FMFIA  requirements. 

A  way  to  eliminate  this  discrepancy  is  to  design  a  one-page 
document,  the  maximum  length  equalling  the  front  and  back  of  a 
single  page,  as  a  separate  checklist.  This  abbreviated  checklist 
would  not  have  the  boilerplate  of  the  complete  checklist,  but  would 
contain  only  the  barest  essentials,  the  very  essence  of  the  appli¬ 
cable  regulation.  Such  abbreviation  would  especially  enhance 
wartime  utilization  of  the  checklists.  The  AUMs  and  line  managers 
don't  need  detailed  control  objectives  and  techniques,  because 
these  managers  are  at  the  ground  level  applying  the  regulation 
daily.  What  they  need  is  a  set  of  test  questions  getting  at  the 
very  heart  of  the  regulatory  requirements. 

These  "indicator”  questions  would  address  only  the  highest 
risk,  highest  payoff  areas,  those  conducive  to  fraud,  waste,  or 
abuse,  and  those  for  which  external  performance  data  are  available. 
If  not  answerable  with  a  positive  ("yes")  response,  the  indicator 
question  would  by  definition  reveal  a  significant  internal  control 
weakness.  The  "no"  answer  would  then  trigger  completion  of  the 
entire  detailed  checklist,  or  at  least  that  portion  of  it 


36 


containing  the  event  cycle  with  the  "no"  answer.  To  give  time  for 
accurate  completion  of  the  checklists,  plus  time  to  correct 
deficiencies  before  annual  assurance  statement  preparation,  all 
checklists  should  be  completed  in  the  first  half  of  the  year. 

In  addition,  all  "no"  answers  not  resolved  by  the  end  of  the 
year  would  automatically  require  reporting  up  the  chain  as  "signi¬ 
ficant"  (as  opposed  to  "material")  internal  control  weaknesses.  A 
full  description  of  the  "no"  answers,  including  the  test  method  and 
statistics  leading  to  the  "no"  responses,  would  accompany  the  an¬ 
nual  assurance  statement,  or  possibly  even  take  the  place  of  the 
feeder  assurance  statement.  This  would  eliminate  the  requirement 
for  commanders  and  managers  to  decide  whether  a  weakness  was 
material.  It  would  also  immeasurably  aid  HQDA  in  determining 
exactly  how  bad,  and  how  widespread,  the  deficient  condition  was. 

The  determination  of  materiality  would  (and  should)  be  left  up 
to  the  Secretary  of  the  Army,  based  on  AICO  and  functional 
proponent  recommendations  and  taking  into  account  the  status  of  the 
particular  subtask  Army-wide.  A  complete,  over-arching  picture  of 
material  weaknesses  can  form  only  at  the  HQDA  level.  The  correc¬ 
tive  effort  could  then  become  focused  strictly  on  the  key  issues 
and  highest  risks.  Subordinate  commanders  and  managers  would 
presumably  continue  to  work  to  correct  their  significant  weak¬ 
nesses,  but  put  forth  a  special  effort  on  those  which  ended  up  as 
Army  MWs.  This  program  simplification  thus  helps  bridge  the  gap 
between  daily  application  of  the  GAO  standards  at  the  lowest 
managerial  levels  and  achievement  of  reasonable  assurance  at  the 
HQDA  level. 
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CONCLUSION 


The  changes  described  in  Section  V  above  are  summarized  in 
Appendix  A,  and  the  corresponding  regulatory  changes  are  shown  in 
Appendix  B.  These  alterations  are  primarily  aimed  at  improving 
execution,  and  can  mostly  be  accomplished  with  little  incremental 
cost.  Some  structural  modifications  are  also  called  for.  Naturally 
the  regulatory  changes  and  training  will  entail  some  costs,  but  the 
overall  benefits  in  significantly  upgrading  the  IMCP  should  far 
outweigh  the  costs.  It  is  an  important  program  which  not  only 
ensures  compliance  with  Public  Law,  but  also  enhances  the  internal 
Army  environment  relative  to  stewardship,  accountability,  ana  the 
like.  As  such,  it  is  likely  to  be  around  for  a  long  while, 
particularly  considering  Congressional  perceptions  of  the  program 
as  a  valuable  oversight  and  early  warning  tool. 

Given  the  intensifying  Congressional  interest  in  internal 
control,  the  time  is  right  to  make  any  necessary  changes.  The  Army 
leads  the  other  services;  retaining  this  lead  by  creating  a  model 
program  could  result  in  its  adoption  by  DoD  as  the  standard. 
Shrinking  defense  budgets  dictate  the  elimination  of  unnecessary  or 
duplicative  functions  and  mandate  the  consistent  application  of  the 
twelve  GAO  standards.  The  availability  of  fewer  resources  also 
requires  a  concentration  of  effort  on  the  critically  high  risk 
areas,  including  those  "too  tough  to  solve"  problems.  In  fact, 
there  may  be  no  better  time  to  identify  and  solve  such  problems, 
using  the  new  and  improved  Army  internal  management  control 
pro  gram . 
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APPENDIX  A 


SUMMARY  OF  IMCP  CHANGES 


E  x  e  c  u  t  i  o  n 

Increase  command  emphasis 
Improve  accountability 

Apply  management  techniques  (MBO.MBE) 

Focus  on  relatively  high  risk  areas 

Upgrade  training 

Better  coordinate  oversight 

Publicize  changes,  as  well  as  IMCP  in  general 
Structure 

Scrub,  then  publish,  detailed  checklists  with  ARs 
Devise  abbreviated  checklists 
Employ  significant  weakness  concept 
Revise  AR  11-2  (Appendix  B) 

Possible 

Apply  TQM 

Move  AICO  under  Seer etary /Under secretary  of  the  Army 

Automate,  and  track  corrective  actions  on,  Reminder 
Listings 

Periodically  hold  teleconference  of  oversight  agencies 
and  AICO  -  ICA  network 

Develop  ” top  ten”  or  similar  list  to  better  focus  effort 

Mandate  IMCP  training  for  ICAs  and  key  I G / I R  personnel 

Replace  subordinate  annual  assurance  statements  with 
reports  of  significant  internal  control  weaknesses 
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APPENDIX  B 


RECOMMENDED  REGULATORY  CHANGES 


Definite 


Define  "significant  internal  control  weakness" 

Require  all  significant  internal  control  weaknesses  to  be 
reported  annually 

Define  role  of  Internal  Review  in  program 

Define  role  of  public  affairs  offices  at  all  levels  in 
identifying  internal  control  weaknesses 

Require  A1C0  to  chop  on  all  ARs  containing  internal  control 
check  1 i s t s /aspect s ,  as  well  as  all  risk  assessments 

Develop  job  standard  for  "all  other"  commanders/managers 

Add  requirement  of  AR  36-2  regarding  performance  rating  or 
OER  comment  on  failure  to  properly  correct  audit  findings 

Include  language  on  parent-tenant  relationships  vis-a-vis 
IMCP,  plus  need  for  support  agreement  between  tenant  and 
instal lation 

Require  annual  review  of  all  high  risk  areas 


Possible 


Add  language  on  standards  of  conduct  (management  and  employee 
responsibilities  for  internal  control,  relative  to  public 
trust/stewardship) 

Change,  or  require  comments  on,  performance  rating  and 
OER/NCQER  regarding  internal  control  responsibilities 

Add  language  regarding  use  of  IMCP  results  as  performance 
measure 
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